Revision as of 15:36, 10 December 2008

The Sleuth Kit (TSK) is a collection of UNIX-based command line tools that allow you to investigate a computer. The current focus of the tools is the file and volume systems and TSK supports FAT (12/16/32), Ext2/3, NTFS, UFS (1 & 2), and ISO 9660 file systems.

Autopsy is a frontend for TSK which allows browser-based access to the TSK tools.

Features

The Sleuth Kit is arranged in layers. There is a data layer which is concerned with how information is stored on a disk and a metadata layer which is considered with information such as inodes and directories. The commands that deal with the data layer are prefixed with the letter d, which the commands that deal with the metadata layer are prefixed with the letter i.

Some of the commands in Sleuth Kit are:

dcat

Views the contents of a block.

dls

Lists unallocated blocks. Makes keyword searches more efficient. Gets a list of unallocated blocks.

dcalc

Tells you where an unallocated blocks are.

dstat

Details about a given block.

icat

View contents of a file given its inode value or cluster number. Doesn't list directories, lists the contents.

ils

Lists the files extents on a disk.

istat

Information about an inode number.

File Systems Understood

• NTFS
• FAT
• Ext2, Ext3
• UFS (1 & 2)
• ISO 9660

File Search Facilities

• Lists allocated and unallocated files.
• Lists and sorts by file type.
• Shows a time of creation and change.

Historical Reconstruction

Searching Abilities

• Searches for keywords.
• Builds an index.

Hash Databases

• Uses MD5 or SHA-1.
• Interfaces with NIST NSRL, Hashkeeper and customer databases.

Evidence Collection Features

• Tracks forensic activity.

History

License Notes

Is it commercial or open source? Are there other licensing options?

See Also

• The Sleuth Kit How-To

External Links

• Autopsy website

External Reviews